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514 
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516 
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522 
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FIG. 5 
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601 



( start Y 



602 



Receive network frame and 
first PDU layer identification 



604 



Retrieve protocol knowledge 
for current PDU identification 



606 



Extract decode information 



607 



Retrieve next layer protocol 
name from the appropriate field 



608 



610 



Create protocol decode 



Store protocol decode 



FIG. 6 
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FIG. 8A 

802 
\ 

protocol "IP" {// 

len=valueof(field "Total Length") *8 
^ mlnLen =20*8 //just header 
804 maxLen =65535*8 
header "IP Header" 
806 ^Payload "IP Payload" 
808 

header "IP Header" {// 

810 

\ ^ len=valueof (field "Header Length")*32 
81 2/ field "Version" 818 
816 field "Header Length" ^ 

^ compoundjield "Type Of Service" 
81 4^ field "Total Length" 

824 820 

field "Identification" {len= 1 6 default=291 } ^ 
^ compoundjield "Flags" 822 
815 field "Fragment Offset" {len = 13 desc="in 64 bits units"} ^ 826 
field "Time To Live" {len=8 default=30 desc="seconds"} ^ 
^ field "Protocol" 830 
828 field "Header Checksum" ^ 

-"field "Source IP Address" {len=32 display=ipv4 field_type= 
832 must_encode} 

a field "Destination IP Address" { 
834 len=32 

display=ipv4 

fieldtype = must_encode 

} 
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816 FIG. 8B 

^repeat { 

len=valueof (field "Header Length") - 5 )*32//in eludes padding 
compoundjield "Options" 

} 

field "Version" { 

len=4 

default =4 

possib!e_va!ues = { 
0,15:"Reserved" 
1-3:"Unassigned" 

6-14:"Unassigned" 
4:"IP Internet Protocol" 
5:"ST ST Datagram Mode" 
}} 

field "Header Length" { 
len=4 

minValue=5 
desc="in 32 bit units" 

default=eval_fn(len, "IP", "IP Header", 732") 

} 

field "Total Length" { 

minValue=20 
len = 16 

desc="in octets include header length" 
default =eval_fn(len, "IP", "IP", 78") 

} 

field "Header Checksum" { 
len=16 

default=eval_fn(checksum, "IP", "IP Header") 
display = hex 

} 
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FIG. 8C 



compoundjield "Type Of Service" {// 

display = hex 

field "precedence" { 

len=3 

possible_values= { 

0:"Routine" 
1 :"Priority" 
2:"lmmediate" 
3:"Flash" 

4:"Flash override" 
5:"CRITIC/ECP" 
6:"lnternetwork Control" 
7:"Network Control" 
}} 

field "Delay" { 
len=1 

possible_values={0:"normal" 1 :"low"}} 

field "Throughput" { 
len=1 

possible_values= {0:"normal" 1 :"high"}} 

field "Reliability" { 
len=1 

possible_values= {0:"normal" 1 :"high"}} 

field "Monetary Cost" { 
len=1 

possible_values={0:"normal" 1 :"low"}} 

field "Unused" { 
len=1 

possible_values={0:"valid"}} 
}// end of field "Type of Service" 
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FIG. 8D 

compoundjield "Flags" { 
len=3 

display = hex 
field "Reserved" { 
len=1 

possible_values={0:"valid"}} 

field "Fragment" { 
len=1 

possible_values={0:"May Fragment" 1 ."Don't Fragment"}} 
field "Fragments" { 
len = 1 

possible_values={0:"last" 1 :"more"}} 

} 

compoundjield "Options" {// 

optional = (valueof(field "Header Length") > 5) 
compoundjield "Option Tuple" 

{ 

len=8; 
display = hex 
field "Copied Flag" { 
len=1 

possible_values={0:"not copied into all fragments 
0:"not copied into all fragments on fragmentation" 
1 :"copied into all fragments on fragmentation" 

}> 

field "Option Class" { 
len=2 

possible_values={ 
0:"control" 
1 ."reserved for future use" 

2."debugging and measurement" 
3:"reserved for future use" 
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FIG. 8E 

field "Option Number" { 
len=5 

field_type= muloptotherfld 
possible_values={ 
0:"end of option list" 
1 :"no operation" 
2:"seeurity" 

3:"loose source routing" 
4:"internet timestamp" 

7:"record route" 
8: "stream ID" 

9:"strict source routing" 

}} 
} 

switch (valueof (field "Option Number")) { 
0:null 

1 mull 

2:compound_field "Security" 
3:compound_field "Loose Source Routing" 
9:compound_field "Strict Source Routing" 
7:compound_field "Record Route" 
8:compound_field "Stream ID" 
4:compound_field "Internet Timestamp" 

} 

compound jield "Security"! 
Ien=80 

field "Security Length" { 
len=8 

possible_values={OxOb:"valid"}} 
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FIG. 8F 

field "Security: Security" 

field "Compartments" {len= 16} 

field "Handling Restrictions" {len = 16} 

field "Transmission Control Code" {len=24} 

field "Security Security" { 
len=16 

possible_values={ 
0:"unclassified" 
0xf1 35: "confidential" 
0x0789a:"EFTO" 
0xbc4d:"MMMM" 
0x5e26:"PROG" 
0xaf13:"Restricted" 
0xd788:"Secret" 
0x6bc5:"Top Secret" 
0x35e2,0x9af 1 ,0x4d78,0x24bd,0x1 35e,0x89af ,0xc4d6,0xe26b: 
"Reserved for future use" 

}} 

} 

compoundjield "Strict Source Routing" { 
len = (valueof (field "Strict Source Routing Length")-1 *8 
field "Strict Source Routing Length" {len =8 } 
field "Strict Source Routing Pointer" {len=8 minValue=4} 

repeat { 

len = (valueof (field "Strict Source Routing Length")-3)*8 

field "source address" {!en=32 disp!ay=ipv4} 

} 

} 
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FIG. 8G 

compoundjield "Loose Source Routing" { 

len=(valueof (field "Loose Source Routing Length")-1*8 

field "Loose Source Routing Length" {len=8 } 

field "Loose Source Routing Pointer" {len=8 minValue=4} 
repeat { 

len=(valueof (field "Loose Source Routing Length")-3)*8 

field "source address" {len=32 display=ipv4} 

} 

} 

compound_field "Record Routing" { 

len=(valueof (field "Record Routing Length")-1)*8 

field "Record Routing Length" {len=8 } 

field "Record Routing Pointer" {len=8 minValue=4} 
repeat { 

len=(valueof (field "Record Routing Length")-3)*8 
field "source address" {len=32 display =ipv4} 
} 

} 

compoundjield "Stream ID" { 
len=24 

field "Stream ID Length" { 
len=8 

default=4 

possible_values= 
0x04: "valid" 

}} 

field "ID" {len=16 default=4} 

} 
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FIG. 8H 

compound_field "Internet Timestamp" { 
field "Internet Timestamp Length" {len=8 } 
field "Internet Timestamp Pointer {len=8 } 
field "Overflow" { 
!en=4 

desc="number of IP modules that cannot register timestamps' 
} 

field "Flag" { 
len=4 

possible_values=1 
0:"time stamps only, stored In consecutive 32-bit words" 
1 :"each timestamp is preceded with internet address" 
3:"the internet address fields are prespecified" 
}} 

} // end of Internet Timestamp 
} // end of field "option" 

} // end of field "IP" 

field "Protocol" { 
len=8 

default =255 

fieldjype = mulopt_prtcl_fld 
display = hex 

possible_values={ // 

0:"HOPOPT (IPv6 Hop-by-Hop Option)" 
1 :"ICMP (Internet Control Message)" 
2:"IGMP (Internet Group Management)" 
3:"GGP (Gateway-to-Gateway)" 
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FIG. 81 

4:"IP (IP in IP encapsulation)" 

5:"ST (Stream)" 

6:"TCP" 

7:"CBT' 

8:"EGP (Exterior Gateway Protocol)" 

9:"IGP (any private interior gateway)" 

10:"BBN-RCC-MON (BBN RCC Monitoring)" 

1 1 :"NVP-II (Network Voice Protocol)" 

12:"PUP" 

13:"ARGUS" 

14:"EMCON" 

1 5:"XNET (Cross Net Debugger)" 

16:"CHAOS" 

17:"UDP" 

18:"MUX (Multiplexing)" 

19:"DCN-MEAS (DCN Measurement Subsystems)" 

20:"HMP (Host Monitoring)" 

21 :"PRM (Field Radio Measurement)" 

22:"XNS-IDP (XEROX NS IDP)" 

23:"TRUNK-1 (Trunk-1)" 

24:"TRUNK-2 (Trunk-2)" 

25:"LEAF-1 (Leaf-1)" 

26:"LEAF-2 (Leaf-2)" 

27:"RDP (Reliable Data Protocol)" 

28:"IRTP (Internet Reliable Transaction)" 

29:"ISO-TP4 (ISO Transport Protocol Class 4)" 

30:"NETBLT (Bulk Data Transfer Protocol)" 

31:"MFE-NSP (MFE Network Services Protocol)" 

32:"MERIT-INP (MERIT Internodal Protocol)" 

33:"SEP (Sequential Exchange Protocol)" 

34:"3PC (Third Party Connect Protocol)" 

35:"IDPR (Inter-Domain Policy Routing Protocol)" 

36:"XTP (XTP)" 
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FIG. 8J 

37:"DDP (Datagram Delivery Protocol)" 

38:"IDPR-CMTP (IDPR Control Message Transport Protocol)" 

39:"TP+ + (TP+ + Transport Protocol)" 

40:"IL (IL Transport Protocol)" 

41 :"IPv6 (IPv6)" 

42:"SDRP (Source Demand Routing Protocol)" 
43:"IPv6-Route (Routing Header for IPv6)" 
44:"IPv6-Frag (Fragment Header for IPv6)" 
45:"IDRP (Inter-Domain Routing Protocol)" 
46:"RSVP (Reservation Protocol)" 
47:"GRE (General Routing Encapsulation)" 
48:"MHRP (Mobile Host Routing Protocol)" 
49:"BNA" 

50:"ESP (Encap Security Payload for IPv6)" 

51 :"AH (Authentication Header for IPv6)" 

52:"!-NLSP (Integrated Net Layer Security TUBA)" 

53:"SWIPE (IP with Encryption)" 

54:"NARP (NBMA Address Resolution Protocol)" 

55:"MOBILE (IP Mobility)" 

56:"TLSP (Transport Layer Security Protocol)" 

57:"SKIP" 

58:"IPv6-ICMP (ICMP for IPv6)" 

59:"IPv6-NoNxt (No Next Header for IPv6)" 

60:"IPv6-Opts (Destination Options for IPv6)" 

61 :"AHP (Any Host Internal Protocol)" 

62:"CFTP (CFTP)" 

63:"ALN (Any Local Network)" 

64:"SAT-EXPAK (SATNET and Backroom EXPAK)" 

65:"KRYPTOLAN (Kryptolan)" 

66:"RVD (MIT Remote Virtual Disk Protocol)" 

67:"IPPC (Internet Pluribus Field Core)" 

68:"ADFS (Any Distributed File System)" 

69:"SAT-MON (SATNET Monitoring)" 

70:"VISA (VISA Protocol)" 
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FIG. 8K 

71 :"IPCV (Internet Field Core Utility)" 

72:"CPNX (Computer Protocol Network Executive)" 

73:"CPHB (Computer Protocol Heart Beat)" 

74:"WSN (Wang Span Network)" 

75:"PVP (Field Video Protocol)" 

76:"BR-SAT-MON (Backroom SATNET Monitoring)" 

77:"SUN-ND (SUN ND PROTOCOL-Temporary)" ~ 

78:"WB-MON (WIDEBAND Monitoring)" 

79:"WB-EXPAK (WIDEBAND EXPAK)" 

80:"ISO-IP (ISO Internet Protocol)" 

81 :"VMTP" 

82:"SECURE-VMTP" 

83:"VINES" 

84:"TTP" 

85:"NSFNET-IGP" 

86:"DGP (Dissimilar Gateway Protocol)" 

87:"TCF" 

88:"EIGRP" 

89:"OSPF" 

90:"Sprite-RPC (Sprite RPC Protocol)" 

91 :"LARP (Locus Address Resolution Protocol)" 

92:"MTP (Multicast Transport Protocol)" 

93:"AX.25 (AX.25 Frames)" 

94:"IPIP (IP-within-IP Encapsulation Protocol)" 

95:"MICP (Mobile Internetworking Control Pro)" 

96:"SCC-SP (Semaphore Communications Sec. Pro)" 

97:"ETHERIP (Ethernet-within-IP Encapsulation)" 

98:"ENCAP (Encapsulation Header)" 

99:"APES (Any Private Encryption Scheme)" 

100:"GMTP" 

101:"IFMP (Ipsilon Flow Management Protocol)" 

102:"PNNI (PNNI over IP)" 

103:"PIM (Protocol Independent Multicast)" 

104:"ARIS" 
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105:"SCPS" 
106:"QNX" 

107:"A/N (Active Networks)" 

108:"IPPCP (IP Payload Compression Protocol)" 

109:"SNP (Sitara Networks Protocol)" 

1 1 0:"Compaq-Peer (Compaq Peer Protocol)" 

111:"IPX-in-IP" 

112:"VRRP (Virtual Router Redundancy Protocol)" 
113:"PGM (PGM Reliable Transport Protocol)" 
1 14:"AHOP (Any 0-hop protocol)" 
115-254:"Unassigned" 
255:"Reserved" 
}} // end of field "protocol" 

} // end of field "IP header" - - 

836 

\ payload "IP Payload" {// 

^ switch(valueof(field "Protocol")) { 
838 1 .protocol "ICMP" 
2:protocol "IGMP" 
6: protocol "TCP" 
17:protocol "UDP" 
46: protocol "RSVP" 
47:protocol "GRE" 
89.protocol "OSPF" 
} 

} // end of packet "IP payload" 
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[p] Passive option 
[r] Restart option 
[s] Silent option 

// Transition conditions 

tc1 - (enabledSilent() = 

tc2 - (enabledSilent() = 

tc3 - (enabled RestartQ = 



= TRUE) 
= FALSE) 
= = TRUE) 
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